PyPI/nova CVE-2026-46448: medium 5.4, EPSS 0.27%
OpenStack Nova: Nova scheduler hint injection bypasses Placement resource claims and scheduling constraints
Action: Upgrade nova to 32.2.1 or later.
pip install nova==32.2.1pip install nova==33.0.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 18.0.0 | - | 31.3.0 |
| 32.0.0 | 32.2.1 | - |
| 33.0.0 | 33.0.2 | - |
Fixed versions
| 32.2.1 | 33.0.2 |
Sources
- osv: GHSA-mfg3-p6m3-gjgr
- https://nvd.nist.gov/vuln/detail/CVE-2026-46448
- https://bugs.launchpad.net/nova/+bug/2151252
- https://github.com/advisories/GHSA-mfg3-p6m3-gjgr
- https://github.com/openstack/nova
- https://github.com/pypa/advisory-database/tree/main/vulns/nova/PYSEC-2026-2686.yaml
- https://pypi.org/project/nova
- https://review.opendev.org/993601
- https://review.opendev.org/993602
- https://review.opendev.org/993603
- https://review.opendev.org/993604
- https://www.openwall.com/lists/oss-security/2026/06/16/5
- http://www.openwall.com/lists/oss-security/2026/06/16/5
CVE-2026-46448 · published · modified · JSON